Description

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's (missing_srcsets[*][*].s)' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The HMAC signature required to pass the REST endpoint's authorization check is published in plaintext to unauthenticated visitors inside the inline optimoleDataOptimizer JavaScript object on any page with an incomplete profile, making the effective authentication barrier nonexistent.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-07T04:17:13.697Z",
  "pubdate": "2026-11-07T04:17:13.697Z",
  "executiveSummary": "The Optimole plugin for WordPress, in versions up to and including 4.2.18, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input sanitization and output escaping mechanisms within the 'missing_srcsets[*][*].s' parameter handled by the plugin's REST API endpoints.\nThe vulnerability is exacerbated by an authentication bypass issue where the HMAC signature, intended to secure the REST endpoint, is exposed in plaintext within the 'optimoleDataOptimizer' JavaScript object on pages featuring an incomplete profile. This allows unauthenticated remote attackers to perform unauthorized actions by injecting malicious JavaScript payloads.\nThe successful exploitation of this vulnerability allows for the execution of arbitrary scripts in the browsers of users accessing the affected pages. This can lead to unauthorized session hijacking, account takeover, the redirection of users to malicious domains, or the theft of sensitive session data. Given that the HMAC signature is exposed publicly, the security barrier for this endpoint is effectively rendered nonexistent, exposing all sites running vulnerable versions of Optimole to potential compromise without requiring legitimate administrative or user credentials.",
  "technicalDetails": "The vulnerability resides in the way the Optimole plugin processes data sent to its REST API endpoints. Specifically, the 'missing_srcsets' parameter, which contains nested array data under 'missing_srcsets[*][*].s', fails to undergo rigorous sanitization or output encoding. When this data is stored and subsequently rendered in the WordPress administrative interface or public-facing pages, the unsanitized input is interpreted as HTML/JavaScript by the victim's browser, triggering stored XSS.\nThe exploit chain relies on two primary weaknesses: the lack of server-side input validation and the exposure of the authentication token. While the REST endpoint requires an HMAC signature for authorization, the plugin exposes this required signature in plaintext via the 'optimoleDataOptimizer' JavaScript object. This object is rendered on any page where the user profile is considered incomplete, effectively making the signature accessible to any unauthenticated visitor to the site.\nThe attack flow proceeds as follows: First, an unauthenticated attacker navigates to a page where the 'optimoleDataOptimizer' object is initialized, extracts the valid HMAC signature from the source code, and uses this signature to authorize a forged request to the vulnerable REST endpoint. The attacker then submits a POST request containing a crafted payload within the 'missing_srcsets[*][*].s' parameter. The server processes this malicious input, storing the JavaScript payload in the database. When an administrator or another user views the compromised page, the browser parses the stored payload, executing the script in the context of the user's session.\nThis vulnerability is classified as Stored XSS because the malicious script is persisted within the site's database, ensuring execution whenever the affected component is loaded. Because the HMAC signature is dynamically exposed, the attacker can consistently bypass the intended authorization logic. The impact is critical, as it allows for full client-side code execution within the administrative context if an administrator visits the compromised entry, potentially leading to privilege escalation, site defacement, or the exfiltration of authentication cookies and session tokens.\nThe affected versions include all releases up to and including 4.2.18. There are no privilege requirements for the initial access as the authorization mechanism is inherently flawed, allowing remote unauthenticated attackers to interact with the vulnerable REST API endpoints over the network."
}